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FIELD 

The invention comprises a system and method for assisting the implementation and 
maintenance of compliance programs required by legislation or established through 
management objectives for the benefit of the organization. 

BACKGROUND 



Programs to ensure compliance with various obligations placed on industry are driven 
by the legislation which places compliance obligations upon businesses, such as 

25 legislation concerning the protection of people, the environment, shareholders, 
equities and other business activities for example. Occupational health and safety 
legislation generally places the responsibility for the management of health and safety 
in the workplace in the hands of employers and their staff. This responsibility 
includes the prevention of harm to an employee by identifying and isolating hazards 

30 and where practical taking action to control, eliminate, and/or minimize hazards. The 
overall objective is to reduce workplace injuries, accidents, illnesses and fatalities 
through an effective health and safety mamagement system, 

Employers are generally required by law to provide an auditable trail of their actions 
35 that is sufficiently transparent to show they have an effective management programme 
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Employers are generally required by law to provide an auditable trail of their actions 
that is sufficiently transparent to show they have an effective management programme 
which includes for example hazard identification, appropriate training and supervision 
of staff, recording details of all accidents and periodically reporting accidents to the 
5 appropriate investigative authority, establishing emergency procedures, and 
management of principals, contractors and subcontractors. 

Similar legislative requirements apply to management of the effects a plant may have 
on the environment, and how under company law a company manages its 
10 shareholders assets. 

Management within an organization may also establish compliance programs within 
the organization aimed at meeting a management objective within the organization, for 
example achieving and implementing procedures for ISO accreditation and 
15 implementation, particularly ISO 14001 and ISO 9001. 

Many businesses are not able to manage the vast number of scenarios that can arise 
and certainly cannot manage these in a "real time mode". Compliance may be 
required under legislation covering companies, health and safety, consumer 

20 protection, electricity, fair trading, human rights, privacy, environmental management, 
property, and land transport legislation. Risk management programs often tend to be 
reactive and address issues randomly. Many companies are not meeting the 
minimum required standards of compliance. This is partly due to a lack of 
commitment and understanding as to how to manage compliance issues, and the 

25 inability to be proactive towards the handling of the vast number of issues involved. 

Many organizations have implemented paper and/or data based compliance programs, 
however these are not fully integrated and fully comprehensive. For example, to meet 
New Zealand Health and Safety Act (NZHSE Act) compliance requirements often each 

30 department of a company is supplied with a resource kit containing information on 
hazard identification, tools for hazard assessment, a serious harm schedule, 
information on how hazards are to be controlled, and forms to record the department 
hazard assessment. The intention is that each department record its own hazard 
identification on forms kept in that department's kit or in the system in some form* 

35 This lype of programme, although adequate for each department if it is kept up to 
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date, has proved inefficient for overall control as it is difficult to continue on an 
ongoing basis to identify and assess significant hazards, because this activity is not a 
natural part of the core operational business. It is also difficult to cross-reference 
hazards and control measures between departments or with others affected by 
5 hazards such as contractors. 

For exaniple, one department may engage in the activity of storing oil. This one 
activity may have many risk-causing aspects such as being stored near water or heat. 
Each of these aspects have a number of results which may occur if an event occurs 
10 such as environmental damage to waterways and wildlife through oil seepage, and 
injury or death to employees in the event of an explosion. Each effect has a number of 
controls involving recovery procedures and plaris to minimize the risk. 

For a department to ensure compliance it must implement all the necessary controls 
15 for a particular activity. This involves cross-referencing each activity to related 
aspects, effects and controls. In general a paper based system or conventional data 
based system is unable to assist in this process. The conventional interrelated data 
base approach is also unable to handle these requirements because of the lairge 
amount of data entry required and large number of controls for each activity. An 
20 exponentially increasing number of relationships between tables and other 
components of the database must be set up in advance by the database designer in 
such prior art systems. 

SUMMARY OF INVENTION 

25 

An object of the invention is to provide an improved system and method for assisting 
the implementation and maintenance of a compliance programme. 

In broad terms the invention comprises a system for assisting an org^ization to 
30 implement and maintain compliance management programs, the system comprising a 
graphical interface which allows a user to display and enter data about legislative 
obligations or other obligations with which the organization is required to comply, the 
interface arranged to display a pluraility of user-selectable modules, each module 
relating to a particular piece of legislation or obligation; at least one master database 
35 for storing compliance criteria on the legislative or other compliance obligations, the 
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master database coupled to the graphical interface for displaying data about the 
legislative or other obligations; at least one slave database for storing information on 
activities of and incidents or accidents in the organization and assessments of the 
organization, the slave database coupled to the graphical interface for user entry of data 
5 about the activities of and incidents or accidents in the organization and assessments of the 
organization; risk assessor interfaced to assign a numerical priority rating to the activity, 
incident, accident or assessment in the slave database; and report generator for generating 
a report on any action required to render the organization compliant with the legislative or 
other requirements in the master database. 

10 

In a further aspect the invention comprises a computer-implemented method for 
assisting an organization to implement emd maintain compliance management 
programs, comprising allowing a user to display and enter data through a graphical 
interface, wherein the data relates to legislative obligations or other obligations with 

15 which the organization is required to comply, the interface arranged to display a 
plurality of user-selectable modules, each module relating to a particular piece of 
legislation or obligation; storing compliance criteria on the legislative or other 
compliance obligations in at least one master database coupled to the graphical 
interface for displaying data about the legislative or other obligations; storing 

20 information on activities of and incidents or accidents in the organization and 
assessments of the organization in at least one slave database coupled to the graphical 
interface for user entry of data about the activities of and incidents pr accidents in the 
organization and assessrnents of the organization; assigning to the activities, incidents, 
accidents or assessments a numerical priority rating and storing the priority rating in the 

25 slave database; retrieving data from the slave database about the organization; 
retrieving legislative or other compliance requirements from the master database; and 
generating a report on action to be taken to render the organization compliant with the 
legislative pr other cprnpliance requirements in the master database. 

30 BRIEF DESCRIPTION OP THE DRAWINGS 

A preferred form of the method and system for assisting the implementation of a 
compliance programme will npw be described by way of example and without 
intending to be limiting, with reference to the accompanying drawings in which: 

35 
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Figure 1 shows a preferred embodiment of the invention; 
Figure 2 illustrates the main menu screen of the preferred form system; 
5 Figure 3 shows the menu screen of one module of the system; 
Figure 4 details one option from the menu screen of Figure 3; 
Figure 5 shows the menu screen of another module of the system; 

10 

•* 

Figure 6 shows one option from the menu screen of Figure 5; 

♦ 

Figure 7 shows another option from the menu screen of Figure 5; 
15 Figure 8 illustrates the navigation function of the invention; 
Figure 9 also illustrates the navigation function; 
Figure 10 illustrates a prior airt data structure arrangement; and 

20 

Figure 1 1 illustrates the data structure of the invention, 
DETAILED DESCRIPTION OP PREFERRED FORM 

25 Figure 1 shows one form of the invention. The system has a CPU (central processing 
unit) 2, a memory 4, and interface circuits 6 and 8, these four components being 
connected to each other by a system bus 10. The interface circuit 6 is connected to an 
input device 12, (for example a keyboard and mouse) and a display device 14. 
Interface circuit 8 is connected to a storage unit 16, such as a hard disk or floppy disk 

30 drive. Data input from the input device 12 is supplied to the CPU 2 via interface 
circuit 6 and system bus 10. Display data is supplied from CPU 2 to the display 
device 14 via the system bus 10 and interface circuit 6. 

Preferably the invention is implemented on a PC having at least 16 MB RAM and 
35 operating system of Microsoft Windows 3.11, Windows 95, Windows 97, Memphis or 
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Windows NT. Preferably Microsoft ACCESS has been installed on the storage unit 16 
together with data and appropriate programmed software to support the invention. 
Alternatively the invention is installed on storage unit 16 as a stand alone application 
independent of Microsoft Access. Preferably storage unit 16 also has installed 
5 spreadsheet and word processing software, for example Microsoft Excel, AMIPRO, 
LOTUS and Microsoft Word. 

Components 2, 4, 6, 8, 12, 14 and 16 may be set up as a stand-alone computer or 
may be connected to further components in a network. Networks rnay be of any type, 
10 for example internet, intranet, local area and wide area networks. The system may 
therefore be implemented on separate networked computers accessible from all or 
selected levels of an organization. 

Figure 2 illustrates the main menu of the preferred form system shown on display 
15 device 14. Using input device 12 a user may access as menu options a Health and 

Safety Manager module, an Environmental Manager module, a Property Manager 

module, a Staff Manager module, and a Training Mainager module. Each module is 

related to a particular piece of legislation with which an orgsmization must comply. 

Any system may include more or less or other similar modules, such as further 
20 modules related to various other pieces of legislation or modules relating to 

management established objectives and procedures with which compliance is to be 

monitored, for example ISO accreditation and compliance. 

The Health and Safety Manager module, accessible as an option from the main menu, 
25 is directed to compliance with occupational health and safety legislation under which 
organizations must typically establish effective methods for identifying and managing 
existing, new and potential instances of occupational overuse syndrome (OOS) in the 
workplace and regularly review these to see whether the instances of OOS are 
significaiit and require further action. 

30 

Figure 3 shows the Health and Safety Manager module user screen presented to the 
user on display device 14. This screen displays a plurality of sub-modules which may 
be selected by the user with input device 12. Some of the sub-modules comprise text 
documents, for example the Training Document Library, the Procedures Document 
35 Library and the General Document Library. These allow various documents (for 
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example on-line manuals on compliance requirements, standards and guidelines) to 
be stored in storage unit 16 and memory 4 for display on display unit 14 when 
selected by the user. The libraries may be preloaded on to storage unit 16 and 
preferably a user may also store further information in storage unit 16 based on 
5 operational experience to build up comprehensive information on the organization's 
compliance needs. 

The Libraries form part of a conceptual master database of information, which may 
actually be implemented either as a single database in storage unit 16, or a plurality 

10 of linked databases installed on storage unit 16, or a plurality of databases installed 
on a plurality of storage units. The master database is in contrast to a conceptual 
slave database which may be installed on one or many storage units in the same way 
as the master database. The slave database is used to record information about an 
organization entered by the user. This information includes activities, aspects, effects 

15 and controls. 

The invention preferably makes provision for supplementing the master database by 
the entry of compliance criteria data into master databases from company records and 
the user's experience as situations arise and policy and legislative requirements are 
20 imposed. For example an environmental compliance requirement driven by legislation 
and/ or company policy has definable criteria and rules. 

Another sub-module of the Health and Safety module, as shown in Figure 3, is the 
Hazard Register. Using the input device 12, the user may select the Hazard Register 

25 which results in the form shown in Figure 4 being presented on display device 14. The 
Hazard Register permits the user to store in the slave database information about 
hazards in an organization. A hazard may have been identified in a number of ways, 
for example an accident, an incident, a hazard or peril assessment, ain audit or an 
observation. As shown in Figure 4 the user is presented with a comprehensive data 

30 entry facility, eliciting information such as the particular division of the organization, a 
hazard description, hazard assessment and hazard isolation and so forth. 

A common hazard in an office environment is the risk to computer operators of OOS. 
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This hazard is prevented by the use of appropriate office furniture and sensible work 
rules for example mandatory rests, and by training on correct posture. A portable or 
mounted digital camera may capture images of an operator's work station. Digital 
photographs of operator posture and work station ergonomics can then be loaded into 
5 the slave database of the Health and Safety Manager of the slave database and 
compared with a correct example from the master database. 

The Hazard Register form allows users to enter data in a plurality of formats. One 
example is the use of a list-box or combo-box which retrieve a set of values from the 

10 master database for the user to select one value. For example, if the user selects the 
Hazard Source field in which to enter data, the Hazard Register form presents a 
number of alternatives from which the user may select a particular hazard source 
retrieved from the master database. Other formats which may be used include boxes 
in which text, numerals, currency values, true/false options and or OLE formats such 

15 as text documents. The Hazard Register form includes programmed macro software 
which ensures that the correct type of data is entered into each box. For example, the 
Hazard Register form includes macro software to ensure that a currency value is 
entered into the Control Cost box. 

20 The Hazard Register, by way of example, forces the user to follow a process and 
pattern of data entry which ensures that relevant • data is captured, as the relevant 
data must be entered by the user when viewing the Hazard Register on display device 
14. As the user must in some cases select data from a list retrieved from the rnaster 
database, this ensures that the data is meaningful. Screen displays show where action 

25 is required and reports on priority issues. 

Following the steps on the various risk assessment forms, the invention retrieves data 
by searching through the fields in the master databases. This searching may be 
implemented in a number of ways, for example macro code to populate a list- box or 
30 combo-box, or code to quick-find keywords in a section of text or form. Alternatively 
the invention may comprise specific macro code segments for searching other 
components of the invention. 
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Data entered into the form is stored in the slave database installed in the storage unit 
16 to form a profile and assessment criteria for the circumstance or activity being 
assessed. 

5 The inventiori also includes a risk assessment means vvhich constantly compares data 
in the slave database about events such as activities, incidents, accidents and 
assessments with compliance criteria from the master database. By way of example, 
the Hazard Register includes Severity and Frequency boxes. The user selects a value 
for the Severity box from a set of criteria retrieved from the master database.. 
10 Preferably the range of values is from 1 (not severe) to 4 (very severe). The user also 
selects a value for the Frequency box from a range of vgilues, preferably 1 (infrequent) 
to 5 (very frequent). 

The invention determines a numerical priority or risk assessment rating as the 
15 product of severity and frequency, and places the rating in the rating box. The rating 
is assigned to the activity, incident, accident or assessment and stored in the slave 
database. The invention includes programmed macros which bring to the attention of 
the user hazards which exceed a certain rating and labels these hazards as significant. 
Preferably hazards with a risk assessment rating above a threshold of 10 are flagged 
20 as significarit. The user may specify the threshold value, enabling an organization to 
concentrate first on high priority hazards by specifying a high threshold, then lowering 
the threshold to concentrate on lower priority hazards. Hazards flagged as significant 
preferably are continually brought to the attention of the user until all actions and 
performance criteria are met. Preferably the invention may produce reports detailing 
25 particular hazards at specific rating thresholds, 

Figure 5 shows the user screen for another module, the Environmental Manager 
module. This module comprises a number of sub-modules including a Training 
Document Library, Procedures Document Library, and General Procedures Library 
30 which contain information on envirorimental compliance requirements, and standards 
imposed by environmental protection legislation, and guidelines for compliance with 
the legislation. The data in the master database may be preloaded or may be input by 
the user based on operational experience to build up comprehensive information on 
the organization's compliance needs. 
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Again the Environmental Manager module provides the user with forms with which to 
update the slave data base containing data about events within the organization such 
as environmental incidents and assessment reports. The slave database may be 
updated using a number of sub-modules including Environmental Risk Investigation, 
5 Environmental Risk Identification, Employee Training etc. 

The master database and slave database associated with the Environmental Manager 
Module operate in the same way as in the Health and Safety Manager module 
previously described. Figure 6 shows the form displayed on the input device 12 for 
10 the Environmental Risk Investigation module. As shown, the invention elicits 
information from the user on environmental risks in the same way as for Heath and 
Safety Hazards as described above. 

The Environmental Manager Module includes an Environmental Risk Identification 
15 form as shown in Figure 7. The form includes an Open Hazard Register box, thereby 
reminding the user that identification of an environmental risk requires further input 
as to hazards. Once the user selects, using the input device 12, the Hazard Register, 
the invention automatically traverses to the Hazard Register shown in Figure 4 ready 
for input by the user. This traversal is implemented by a program macro triggered by a 
20 click-event. 

From the Environrnental Risk Identification form the user is also able to traverse 
directly to the Accident Register form and the Environmental Risk Investigation form. 
If an actual incident occurs and is entered in the system, for example into the Hazard 
25 Register form, the system automatically traverses to the Accident/ Incident Register 
shown in Figure 3 where an assessment is made about the harm or potential harm of 
the incident. 

The system then automatically traverses to the Employee Training Register where 
30 details of training are entered and compares these against training criteria obtained 
from the Training Document Library in the master database. Details of the training 
criteria are attached to the personal training record for the person involved. The 
system then traverses, the personal record to input health assessment data required 
by law and prepares the health assessment routines required for the persons involved. 
35 The traversing function is continued to include hazard management for property and 
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the environment, thereby providing a comprehensive model of management, 
compliance and control over individual situations. 

This traversal is provided by a navigator, the operation of which is illustrated in 
5 Figures 8 and 9, The navigator guides the user on a step-by-step basis on the actions 
necessary to implement compliance management procedures, through the system and 
through voider netw^orks to other systems. Other systems include other software 
packages for example spreadsheet and word processing software and other databases. 
By use of the navigator, the user is able to efficiently select data and criteria for 

10 assessment from the master database of a module and attach it to the compliance 
issue. This navigation and assembly allows efficient and accurate compilation of data 
which ranges from two digit numerical ratings to billion bit data objects. The 
navigator may operate on an area wide network or any such networking system 
enabling anyone within an brgatnization to use and interact with the system making 

15 compliance transpsurent at all levels of an organization. 

The navigator uses its tools to locate, import and attach virtually unlimited types and 
amounts of data relating to compliance in the master database and attaches this 
information directly to each circumstance, activity and entity for entry into the slave 

20 database. This technique is used to enable a conventional office and company 
computer based administration programme to interface with the compliance 
management system. Documents, reports, spreadsheets, drawings, pictures and any 
other form of OLE based objects relating to compliance management generated 
throughout an organization are captured by the navigator and stored in the 

25 appropriate location. This information is stored in master and slave databases used to 
support the management criteria stored in the program. 

« 

Prior art systems of this kind use relationships which are specified by the database 
designer when the system is implemented. An example of a prior art system is 

30 illustrated in Figure IQ. In conventional database design, relationships between 
tables are implemented by first identifying the fields in the tables, then setting 
relationships between fields using manual drag and drop actions or relationship 
building tools such as WIZARD. Once these relationships have been formed the 
relational boundaries cannot be transgressed and the relational aspects of the 

35 database design constrain use outside predefined relational criteria. 
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Defining relationships between tables may be difficult due to the complexity of the 
data represented. For example, each organization may have a number of activities in 
which they may engage. Each activity may have a number of aspects and each of 
5 these aspects may in turn have many effects. Each effect has a number of controls 
involving plans and recovery procedures to minimize the risk. The exponentied number 
of controls needed for a single activity places significant demands on conventional 
database designs, A single organization may have many departments and employees. 
Individual employees may have accidents in departnients other than the one in which 
10 they work. Other individuals who are not employees at all of the organization may 
have accidents in one or more departments. The present invention permits 
implementation of a database design in which the data is not placed in tables with 
predefined relationships between tables to handle these situations. 

15 The system of the invention shown in Figure 11 is designed with a special relational 
structure allowing relationships to be dynamically created and destroyed when 
required by the navigator. 

Macros operate to make and abandon relationships which enable the relational 
20 boundaries associated with tables and queries to be traversed. The macros locate 
where data is physically located and what action is to be taken on it. This is essential 
for all tables containing compliance on such issues as health ar^d safety of people, 
environment, property etc to be cross referenced so as relevaint scenarios for each 
assessment can be compiled in the slave database tables. 

25 

Relationships between the various fields in the databases are created in the source 
code and switch on and off using macro functions triggered by Windows events such 
as click, double-click, mouse-down, mouse-move etc. This allows the macro functions 
to be executed when the user opens and closes the related database access forms and 
30 operating tools such as list-box and combo-boxes in the forms enabling unlimited 
combination of data from the fields in the master database to be assembled in the 
slave database. 

By way of example, a department has a one to many relation with its staff (a 
35 department has many staff). However staff can have accidents in many departments 
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which causes a conflict with this one to many relationship. The source code contains 
a macro that disables the relationship between the department and its staff. All staff in 
each department are identified and this information is made available to the user so 
that the user may select the staff mernber who has had an accident and place all 
5 relevant information about that staff member in the slave database as a record of the 
accident even if that person is not part of the department. This enables the many 
cross relationships necessary to operate the compliance program. 

» * * 

This macro assisted handling of relationships provides the system with greater 
10 flexibility than has previously been possible, as there are no constraints on the types 
of relationships which may be made between various components of the system. It 
also means that the modules need not be stored in a rigid data format imposed by the 
database designer, which may render some modules incompatible and unable to 
interact. 

15 

A consequence of the design of the invention means that additional modules may be 
incorporated into the system at a later date without substantial rnodification. The 
types of permissible modules and sub-modules may range from simple forms to 
complex application programs. This enables the use of a comprehensive number of 
20 software applications to interact to capture and present the data. 

In summary the operation of the system of the invention is as follows: 

1 . The program makes provision for the entry of compliance criteria data into 
25 Master databases from company records and experience as situations arise 

and policy and legislative requirements are imposed. 

2. Following the steps on the various risk assessment forms, the program 
searches through the fields in the master databases to match criteria from 

30 the master databases records with the activity being assessed. 

3. This data is lodged in the fields of the islave databases to form a profile and 
assessment criteria for the circumstance or activity being assessed. 
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4. Relationships between the various fields in these databases are created in 
the source code and switch on and off using macro functions when opening 
and closing the related database access forms airid operating tools such as 
list and combo-box icons enabling an unlimited combination of data from the 

5 fields in the master database to be assembled in the slave databases. 

* ' ■ 

5. The scenarios are rated through a process of questions and answers and the 
selected priority issues above a criteria of 10 are reported on. Issues in the 
priority categories remain before management for action until all 

10 performance criteria are met. 

6. The program combines and matches compliance requirements that 
trainsverse many Eireas of compliance areas and inter related issues by 
combining data and criteria from any part of the databases, computer and 

15 network systems. Computer and network navigation and functioning is 

facilitated by the navigator system. 

7. The navigator uses its tools to locate, import and attach virtually unlimited 
types cind amounts of data relating to compliance and attaches this 

20 information directly to each circumstance, activity and entity. 

Using data from the various modules, the system may produce management reports 
including accident records together with statistics to assist an organization to 
implement and maintain compliance management programs. The rnanagement 
25 reports may include information about hazard management prograrns, workplace 
control procedures and checklists. Generation of these reports permits action to be 
taken by the organization to render it compliant with the legislative requirements in 
the master databases. 

30 The foregoing describes the invention including preferred forms thereof. Alterations 
and modifications as will be obvious to those skilled in the art are intended to be 
incorporated within the scope hereof, as defined in the accompanying claims. 
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